p PatchFirst

CVE-2021-44649

CVE-2021-44649

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting (XSS) vulnerability. The vulnerability allows an attacker to execute arbitrary JavaScript code in the web browser of the affected user.

CVSS 5.4 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • django-cms PyPI

    Versions
    • 3.7.0
    • 3.7.1
    • 3.7.2
    • 3.7.3
    Affected ranges
    • ECOSYSTEM: ≥ 3.7.0, < 3.7.4

    Update to 3.7.4

  • django-cms PyPI

    Versions
    • 3.6.0
    Affected ranges
    • ECOSYSTEM: ≥ 3.6.0, < 3.6.1

    Update to 3.6.1

  • django-cms PyPI

    Versions
    • 3.5.0
    • 3.5.1
    • 3.5.2
    • 3.5.3
    Affected ranges
    • ECOSYSTEM: ≥ 3.5.0, < 3.5.4

    Update to 3.5.4

  • django-cms PyPI

    Versions
    • 3.4.0
    • 3.4.1
    • 3.4.2
    • 3.4.3
    • 3.4.4
    • 3.4.5
    • 3.4.6
    Affected ranges
    • ECOSYSTEM: ≥ 3.4.0, < 3.4.7

    Update to 3.4.7

  • django-cms PyPI

    Versions
    • 3.4.0
    • 3.4.1
    • 3.4.2
    • 3.4.3
    • 3.4.4
    • 3.4.5
    • 3.4.6
    • 3.5.0
    • 3.5.1
    • 3.5.2
    • 3.5.3
    • 3.6.0
    • 3.7.0
    • 3.7.1
    • 3.7.2
    • 3.7.3
    Affected ranges
    • ECOSYSTEM: ≥ 3.4.0, < 3.4.7 ∪ ≥ 3.5.0, < 3.5.4 ∪ ≥ 3.6.0, < 3.6.1 ∪ ≥ 3.7.0, < 3.7.4

    Update to 3.4.7; Update to 3.5.4; Update to 3.6.1; Update to 3.7.4

Original sources

Check your server →